Members are responsible for the proper management of all personal information under their control, and shall designate one or more persons to be accountable for compliance.
Members shall identify the purposes of collecting information before or at the time the information is collected.
The knowledge and consent of the consumer are required for the collection, use or disclosure of personal information except where inappropriate.
Members shall limit the collection of personal information to that which is necessary for the purposes identified.
Members shall use or disclose personal information only for the reason it was collected, except with the consent of the consumer or as required by law.
Members shall keep personal information as accurate, complete, current and relevant as necessary for its identified purpose.
Members shall protect personal information with safeguards appropriate to the sensitivity of the information.
Members shall make readily available to consumers specific information about their policies and practices relating to the management of personal information.
Upon request, members shall inform a consumer of the existence, use and disclosure of his or her personal information and shall give the individual access to that information.
A consumer shall be able to address a challenge concerning compliance with the above principles to the designated accountable person or persons in the member office.